@heybox/hb-sdk 0.6.1 → 0.6.3

package/dist/vite.esm.js

@@ -1,17 +1,10 @@
 import { readFileSync, existsSync, writeFileSync, mkdirSync, readdirSync } from 'node:fs';
 import path from 'node:path';
-import require$$0 from 'path';
-import require$$1 from 'os';
-import { readFile, mkdir, writeFile, rename } from 'node:fs/promises';
 
 /** 构建时替换为当前发布包的实际版本。 */
 const HB_SDK_VERSION = typeof undefined === 'string'
     ? undefined
-    : '0.6.1';
-
-function getDefaultExportFromCjs (x) {
-	return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, 'default') ? x['default'] : x;
-}
+    : '0.6.3';
 
 var re = {exports: {}};
 
@@ -11584,328 +11577,9 @@ function walk(node, visit) {
         walk(node.content, visit);
 }
 
-var envPaths$1 = {exports: {}};
-
-var hasRequiredEnvPaths;
-
-function requireEnvPaths () {
-	if (hasRequiredEnvPaths) return envPaths$1.exports;
-	hasRequiredEnvPaths = 1;
-	const path = require$$0;
-	const os = require$$1;
-
-	const homedir = os.homedir();
-	const tmpdir = os.tmpdir();
-	const {env} = process;
-
-	const macos = name => {
-		const library = path.join(homedir, 'Library');
-
-		return {
-			data: path.join(library, 'Application Support', name),
-			config: path.join(library, 'Preferences', name),
-			cache: path.join(library, 'Caches', name),
-			log: path.join(library, 'Logs', name),
-			temp: path.join(tmpdir, name)
-		};
-	};
-
-	const windows = name => {
-		const appData = env.APPDATA || path.join(homedir, 'AppData', 'Roaming');
-		const localAppData = env.LOCALAPPDATA || path.join(homedir, 'AppData', 'Local');
-
-		return {
-			// Data/config/cache/log are invented by me as Windows isn't opinionated about this
-			data: path.join(localAppData, name, 'Data'),
-			config: path.join(appData, name, 'Config'),
-			cache: path.join(localAppData, name, 'Cache'),
-			log: path.join(localAppData, name, 'Log'),
-			temp: path.join(tmpdir, name)
-		};
-	};
-
-	// https://specifications.freedesktop.org/basedir-spec/basedir-spec-latest.html
-	const linux = name => {
-		const username = path.basename(homedir);
-
-		return {
-			data: path.join(env.XDG_DATA_HOME || path.join(homedir, '.local', 'share'), name),
-			config: path.join(env.XDG_CONFIG_HOME || path.join(homedir, '.config'), name),
-			cache: path.join(env.XDG_CACHE_HOME || path.join(homedir, '.cache'), name),
-			// https://wiki.debian.org/XDGBaseDirectorySpecification#state
-			log: path.join(env.XDG_STATE_HOME || path.join(homedir, '.local', 'state'), name),
-			temp: path.join(tmpdir, username, name)
-		};
-	};
-
-	const envPaths = (name, options) => {
-		if (typeof name !== 'string') {
-			throw new TypeError(`Expected string, got ${typeof name}`);
-		}
-
-		options = Object.assign({suffix: 'nodejs'}, options);
-
-		if (options.suffix) {
-			// Add suffix to prevent possible conflict with native apps
-			name += `-${options.suffix}`;
-		}
-
-		if (process.platform === 'darwin') {
-			return macos(name);
-		}
-
-		if (process.platform === 'win32') {
-			return windows(name);
-		}
-
-		return linux(name);
-	};
-
-	envPaths$1.exports = envPaths;
-	// TODO: Remove this for the next major release
-	envPaths$1.exports.default = envPaths;
-	return envPaths$1.exports;
-}
-
-var envPathsExports = requireEnvPaths();
-var envPaths = /*@__PURE__*/getDefaultExportFromCjs(envPathsExports);
-
-const APIUserMiniprogramPublicSdkConfigPath = '/user_miniprogram/public/sdk_config';
-function createUserMiniprogramPublicSdkConfigRequest(serviceTag) {
-    return {
-        path: APIUserMiniprogramPublicSdkConfigPath,
-        searchParams: serviceTag ? { special_tag: serviceTag } : {},
-        headers: serviceTag ? { 'x-rylai-service-tag': serviceTag } : {},
-    };
-}
-function parseUserMiniprogramPublicSdkConfigResult(value) {
-    if (!isRecord(value) ||
-        typeof value.minimum_sdk_version !== 'string') {
-        throw new Error('公共 SDK 配置响应无效');
-    }
-    return value;
-}
-function parseUserMiniprogramPublicSdkConfigEnvelope(value) {
-    if (!isRecord(value) || value.status !== 'ok') {
-        throw new Error('公共 SDK 配置响应无效');
-    }
-    return parseUserMiniprogramPublicSdkConfigResult(value.result);
-}
-function isRecord(value) {
-    return typeof value === 'object' && value !== null;
-}
-
-const PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH = APIUserMiniprogramPublicSdkConfigPath;
-
-const CACHE_MAX_AGE_MS = 24 * 60 * 60 * 1_000;
-const CACHE_FILE_NAME = 'minimum-sdk-versions.json';
-async function resolveMinimumSdkVersion(options) {
-    const now = options.now ?? Date.now();
-    const cachePath = path.join(options.cacheDir, CACHE_FILE_NAME);
-    const cache = await readCache(cachePath);
-    let minimumSdkVersion;
-    try {
-        minimumSdkVersion = validateStableSdkVersion(await options.fetchMinimumSdkVersion(), 'minimumSdkVersion');
-    }
-    catch {
-        const cached = cache.environments[options.environment];
-        const cacheAge = cached ? now - cached.fetchedAt : Number.NaN;
-        if (cached && Number.isFinite(cached.fetchedAt) && cacheAge >= 0 && cacheAge <= CACHE_MAX_AGE_MS) {
-            try {
-                return validateStableSdkVersion(cached.minimumSdkVersion, 'cached minimumSdkVersion');
-            }
-            catch {
-                // 非法缓存按不存在处理。
-            }
-        }
-        throw new Error('MINIMUM_SDK_VERSION_UNAVAILABLE：无法获取最低 SDK 版本，且没有 24 小时内的有效缓存');
-    }
-    cache.environments[options.environment] = { fetchedAt: now, minimumSdkVersion };
-    try {
-        await writeCache(cachePath, cache);
-    }
-    catch {
-        // 已校验的远端策略仍然可信；缓存只是离线回退优化。
-    }
-    return minimumSdkVersion;
-}
-function validateCurrentSdkVersion(currentSdkVersion, minimumSdkVersion, options) {
-    const current = validateSdkVersion(currentSdkVersion, '当前 SDK 版本');
-    const minimum = validateStableSdkVersion(minimumSdkVersion, 'minimumSdkVersion');
-    if (!options.allowPrerelease && semverExports.prerelease(current) !== null) {
-        throw new Error('正式发布不允许使用预发布 SDK，请运行 pnpm add @heybox/hb-sdk@latest 后重新构建');
-    }
-    if (!semverExports.satisfies(current, `>=${minimum}`, { includePrerelease: options.allowPrerelease })) {
-        throw new Error(`SDK_VERSION_TOO_LOW：当前 @heybox/hb-sdk@${current} 低于最低版本 ${minimum}，请运行 pnpm add @heybox/hb-sdk@latest`);
-    }
-    return current;
-}
-function validateSdkVersion(value, label) {
-    const normalized = String(value).trim();
-    const parsed = semverExports.parse(normalized);
-    if (!parsed || parsed.version !== normalized || parsed.build.length > 0) {
-        throw new Error(`${label} 必须是合法 SemVer：${normalized}`);
-    }
-    return normalized;
-}
-function validateStableSdkVersion(value, label) {
-    const normalized = validateSdkVersion(value, label);
-    if (semverExports.prerelease(normalized) !== null)
-        throw new Error(`${label} 必须是稳定 SemVer：${normalized}`);
-    return normalized;
-}
-async function readCache(cachePath) {
-    try {
-        const parsed = JSON.parse(await readFile(cachePath, 'utf8'));
-        if (parsed && typeof parsed === 'object' && parsed.environments && typeof parsed.environments === 'object')
-            return parsed;
-    }
-    catch {
-        // 缓存缺失或损坏时继续请求最新配置。
-    }
-    return { environments: {} };
-}
-async function writeCache(cachePath, cache) {
-    await mkdir(path.dirname(cachePath), { recursive: true });
-    const temporaryPath = `${cachePath}.${process.pid}.tmp`;
-    await writeFile(temporaryPath, `${JSON.stringify(cache, null, 2)}\n`, { mode: 0o600 });
-    await rename(temporaryPath, cachePath);
-}
-
-const globalHeyboxCliRequestConfig = {};
-function readHeyboxCliRequestConfig() {
-    return normalizeHeyboxRylaiServiceTagConfig(globalHeyboxCliRequestConfig);
-}
-function resolveHeyboxRylaiServiceTag(pathWithQuery, config = readHeyboxCliRequestConfig()) {
-    const normalized = normalizeHeyboxRylaiServiceTagConfig(config);
-    const pathname = getPathname(pathWithQuery) ;
-    const specialTag = normalized.special_tag;
-    if (pathname && specialTag?.path_prefix_list.some((prefix) => pathname.startsWith(prefix))) {
-        return specialTag.tag_name;
-    }
-    return normalized.default_tag;
-}
-function normalizeHeyboxRylaiServiceTagConfig(config) {
-    const defaultTag = normalizeHeyboxRylaiServiceTag(config.default_tag);
-    const specialTagName = normalizeHeyboxRylaiServiceTag(config.special_tag?.tag_name);
-    const pathPrefixList = config.special_tag?.path_prefix_list?.filter(isValidPathPrefix) || [];
-    return {
-        ...(defaultTag ? { default_tag: defaultTag } : {}),
-        ...(specialTagName && pathPrefixList.length
-            ? {
-                special_tag: {
-                    tag_name: specialTagName,
-                    path_prefix_list: pathPrefixList,
-                },
-            }
-            : {}),
-    };
-}
-function normalizeHeyboxRylaiServiceTag(value) {
-    const tag = String(value ?? '').trim();
-    if (!tag) {
-        return undefined;
-    }
-    if (/[\r\n]/.test(tag)) {
-        throw new Error('x-rylai-service-tag 不允许包含换行符');
-    }
-    return tag;
-}
-function isValidPathPrefix(value) {
-    return typeof value === 'string' && value.startsWith('/') && !/[\r\n]/.test(value);
-}
-function getPathname(pathWithQuery) {
-    try {
-        return new URL(pathWithQuery, 'https://api.xiaoheihe.cn').pathname;
-    }
-    catch {
-        return '';
-    }
-}
-
-const paths = envPaths('hb-sdk');
-async function enforceViteSdkVersion(options) {
-    const fetchImpl = options.fetchImpl ?? fetch;
-    const serviceTag = resolveHeyboxRylaiServiceTag(PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH, {
-        default_tag: options.serviceTag,
-    });
-    const minimumSdkVersion = await resolveMinimumSdkVersion({
-        cacheDir: options.cacheDir ?? paths.cache,
-        environment: options.environment,
-        fetchMinimumSdkVersion: async () => {
-            const request = createUserMiniprogramPublicSdkConfigRequest(serviceTag);
-            const url = new URL(request.path, options.environment);
-            for (const [key, value] of Object.entries(request.searchParams)) {
-                url.searchParams.set(key, value);
-            }
-            const response = await fetchImpl(url, {
-                headers: request.headers,
-            });
-            if (!response.ok) {
-                throw new Error('公共 SDK 配置响应无效');
-            }
-            return parseUserMiniprogramPublicSdkConfigEnvelope(await response.json())
-                .minimum_sdk_version;
-        },
-    });
-    return validateCurrentSdkVersion(options.sdkVersion, minimumSdkVersion, { allowPrerelease: options.allowPrerelease });
-}
-
-const HEYBOX_API_BASE_URL = 'https://api.xiaoheihe.cn';
-const TRUSTED_HEYBOX_API_HOST_SUFFIXES = ['.xiaoheihe.cn', '.debugmode.cn'];
-function resolveHeyboxApiBaseUrl(options = {}) {
-    const env = options.env;
-    const baseUrl = normalizeHeyboxOriginUrl(options.apiBaseUrl ?? env?.HB_SDK_API_BASE_URL ?? HEYBOX_API_BASE_URL, 'Heybox API baseUrl');
-    assertSafeHeyboxApiBaseUrl(baseUrl, {
-        allowUnsafeApiBaseUrl: options.allowUnsafeApiBaseUrl === true || isTruthyEnvFlag(env?.HB_SDK_ALLOW_UNSAFE_API_BASE_URL),
-    });
-    return baseUrl;
-}
-function normalizeHeyboxOriginUrl(value, label) {
-    const raw = String(value ?? '').trim();
-    if (!raw) {
-        throw new Error(`${label} 不能为空`);
-    }
-    let url;
-    try {
-        url = new URL(raw);
-    }
-    catch {
-        throw new Error(`${label} 必须是合法的 http(s) origin：${raw}`);
-    }
-    if (url.protocol !== 'http:' && url.protocol !== 'https:') {
-        throw new Error(`${label} 只支持 http(s) 协议：${raw}`);
-    }
-    if (url.username || url.password) {
-        throw new Error(`${label} 不允许包含用户名或密码：${raw}`);
-    }
-    const rawSuffix = raw.match(/^[a-z][a-z\d+.-]*:\/\/[^/?#]+(.*)$/i)?.[1] ?? '';
-    if ((rawSuffix && rawSuffix !== '/') || url.search || url.hash) {
-        throw new Error(`${label} 只支持 origin，不允许包含 path、query 或 hash：${raw}`);
-    }
-    return url.origin;
-}
-function assertSafeHeyboxApiBaseUrl(origin, options) {
-    if (options.allowUnsafeApiBaseUrl) {
-        return;
-    }
-    const url = new URL(origin);
-    if (url.protocol !== 'https:' || !isTrustedHeyboxApiHost(url.hostname)) {
-        throw new Error('Heybox API baseUrl 默认只允许 Heybox 受信 HTTPS origin；本地调试请显式使用 --allow-unsafe-api-base-url 或 HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1');
-    }
-}
-function isTrustedHeyboxApiHost(hostname) {
-    return TRUSTED_HEYBOX_API_HOST_SUFFIXES.some((suffix) => hostname === suffix.slice(1) || hostname.endsWith(suffix));
-}
-function isTruthyEnvFlag(value) {
-    return ['1', 'true', 'yes', 'on'].includes(String(value ?? '')
-        .trim()
-        .toLowerCase());
-}
-
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
-function miniappManifest(options = {}) {
+function miniappManifest() {
     let root = process.cwd();
     let outDir = 'dist';
     let command = 'build';
@@ -11929,22 +11603,6 @@ function miniappManifest(options = {}) {
             command = resolved.command;
             hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
         },
-        async buildStart() {
-            if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1')
-                return;
-            try {
-                await (options.enforceSdkVersion ?? enforceViteSdkVersion)({
-                    sdkVersion: resolveSdkVersion(),
-                    environment: resolveHeyboxApiBaseUrl({ env: process.env }),
-                    serviceTag: process.env.HB_SDK_SERVICE_TAG,
-                    allowPrerelease: true,
-                });
-            }
-            catch (error) {
-                priorBuildError = toError(error);
-                throw priorBuildError;
-            }
-        },
         buildEnd(error) {
             if (error) {
                 priorBuildError = priorBuildError ?? toError(error);

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@heybox/hb-sdk",
-  "version": "0.6.1",
+  "version": "0.6.3",
   "sideEffects": [
     "./src/index.ts",
     "./src/core/singleton.ts",

package/skill/SKILL.md

@@ -52,14 +52,14 @@ Apply these instructions when writing, reviewing, or debugging code that consume
 2. Use `hb-sdk dev` for local browser debugging through the built-in mock runtime host. The project must bind `package.json.heybox.miniProgramId` and the CLI must be logged in so dev can load the real Runtime permission snapshot before starting Vite.
 3. Use `hb-sdk remote ...` for developer-owned remote mini-program management. Top-level `hb-sdk deploy` has been hard-cut and must not be recommended as a compatibility alias.
 4. Use `hb-sdk remote entity list`, `hb-sdk remote entity current`, and `hb-sdk remote entity switch <entity-id>` to inspect or change the developer platform server-side current entity before remote management commands.
-5. Use `hb-sdk remote create` to create a remote mini-program under the server-side current entity and bind the returned id into `package.json.heybox.miniProgramId`; use `hb-sdk remote bind <mini-program-id>` to bind an existing remote mini-program after current-entity manageability is verified. Mini-program name, icon, and cover images belong in `package.json.heybox.miniProgramProfile` and are submitted with version audit.
+5. Use `hb-sdk remote create` to create a remote mini-program under the server-side current entity and bind the returned id into `package.json.heybox.miniProgramId`; use `hb-sdk remote bind <mini-program-id>` to bind an existing remote mini-program after current-entity manageability is verified. CLI project configuration contains only `package.json.heybox.miniProgramId`; mini-program name, icon, and cover images are maintained on the Open platform version-publish flow. On first submit without prior approved profile, the server injects a default name and default images.
 6. Use `hb-sdk remote info`, `hb-sdk remote list`, `hb-sdk remote access`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, and `hb-sdk remote allowlist ...` for read/basic/preview management workflows. Mini-program name and image changes must go through version audit, so the CLI must not expose a basic-info update command.
 7. Use `hb-sdk remote deploy --release-note <text>` to build, upload, and submit the current project for audit. It reads `package.json.heybox.miniProgramId`, validates that the bound mini-program belongs to the server-side current entity before precheck/build/upload, prechecks `package.json.version` before build, runs the project's `build` script via the package manager auto-detected by lockfile, uploads `dist/` to CDN (skipping `manifest.json`, `.DS_Store`, `.map`), then calls the submit-audit API. Deploy and `--from-version` do not fetch or compare the client-side `minimumSdkVersion`; Manifest validation and server-side precheck / submit-audit policy still apply. When `--env <name>` or `HB_SDK_ENV=<name>` selects an environment preset, deploy also passes the same name to the project build as its Vite mode. The deploy upload pipeline rejects actual upload artifacts over 100MiB before any upload request, processes CDN upload metadata and callback confirmation at 50 files per batch, keeps 4-way upload concurrency within each batch, and validates CDN-returned keys exactly against the local expected upload keys.
 8. Use `hb-sdk remote deploy --from-version <version> --release-note <text>` to reuse a previously uploaded remote version artifact and submit a new audit version without reading local `dist`, building, or uploading.
 9. Always provide a concise release note before deploy. Non-interactive environments must pass `--release-note`; interactive terminals may prompt for it. The default is manual release after approval with `hb-sdk remote release <version>`; use `--auto-publish` when the audited version should automatically release after approval.
 10. Use `hb-sdk remote release <version>`, `hb-sdk remote withdraw <version>`, `hb-sdk remote take-down`, and `hb-sdk remote reopen` for dangerous remote changes. Interactive terminals should confirm after showing enough context; non-interactive environments must pass `--yes`.
 11. For internal test/staging backend operations, use origin-only custom URLs: `HB_SDK_API_BASE_URL` or `hb-sdk remote ... --api-base-url <url>` for remote platform APIs, and `HB_SDK_LOGIN_BASE_URL` or `hb-sdk login --login-base-url <url>` for browser login. CLI flags override env vars. API base URLs must be Heybox trusted HTTPS origins by default; use `--allow-unsafe-api-base-url` or `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` only for local backend debugging. Do not include path, query, or hash in these URLs.
-12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests and the Vite minimum-SDK-version gate used by manual builds. Deploy builds skip that client-side version gate. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
+12. For development routing or gray validation, use `HB_SDK_SERVICE_TAG` to attach `x-rylai-service-tag` and the matching `special_tag` query parameter to CLI backend requests. Repository-local path-specific routing can still be configured in `packages/hb-sdk/src/cli/config.ts` with `@heybox/hb-types` `RylaiServiceTagConfig` (`default_tag` / path-specific `special_tag`).
 13. If a remote command targets a custom login environment, pass the same `--login-base-url` or `HB_SDK_LOGIN_BASE_URL` used for `hb-sdk login`; remote commands reject cached CLI login state from a different login origin.
 14. Add `--verbose` / `-v` only when diagnosing failures; default CLI errors are intentionally concise, while verbose output includes backend envelope, HTTP status, trace fields, raw body, or original submit-audit failure details.
 15. Use `--json` for script consumption of `hb-sdk remote` commands. With `--json`, stdout must contain exactly one JSON object; progress, warnings, update reminders, and verbose diagnostics must not pollute stdout.

package/skill/references/api-root.md

@@ -19,7 +19,7 @@
 ## Package metadata
 
 - Package: `@heybox/hb-sdk`
-- Version at generation time: `0.6.1`
+- Version at generation time: `0.6.3`
 - Public root export: `@heybox/hb-sdk`
 - Protocol export: `@heybox/hb-sdk/protocol`
 - Vite plugin export: `@heybox/hb-sdk/vite`
@@ -203,25 +203,17 @@ import { HB_SDK_VERSION } from '../core/version';
 import { renderMiniappManifest, validateMiniappPackageVersionForBuild } from '../miniapp-manifest/schema';
 import { readMiniappVersionFromPackageJson } from '../miniapp-manifest/node';
 import { enforceMiniappHtmlPolicy } from './html-policy';
-import { enforceViteSdkVersion as defaultEnforceRemoteSdkVersion } from './sdk-version-gate';
-import { resolveHeyboxApiBaseUrl } from '../cli/auth/base-url';
 
 type MiniappManifestPlugin = {
   name: string;
   config: (config: MiniappManifestUserConfig) => MiniappManifestUserConfig | void;
   configResolved: (resolved: MiniappManifestResolvedConfig) => void;
-  buildStart: () => Promise<void>;
   /** Rollup 在构建失败后仍会跑 closeBundle；用 buildEnd 记录真实错误，避免二次校验掩盖原因。 */
   buildEnd: (error?: Error) => void;
   transformIndexHtml: (html: string) => string;
   closeBundle: (this: MiniappManifestPluginContext) => Promise<void>;
 };
 
-export interface MiniappManifestOptions {
-  /** 仅供平台测试和自托管 Remote Environment adapter 使用。 */
-  enforceSdkVersion?: typeof defaultEnforceRemoteSdkVersion;
-}
-
 interface MiniappManifestUserConfig {
   base?: string;
   define?: Record<string, string>;
@@ -254,7 +246,7 @@ interface MiniappManifestResolvedConfig {
 const sdkVersionPlaceholder = ['__HB_SDK', 'VERSION__'].join('_');
 const sdkVersionBuildConstant = ['__HB_SDK_BUILD', 'VERSION__'].join('_');
 
-export function miniappManifest(options: MiniappManifestOptions = {}): MiniappManifestPlugin {
+export function miniappManifest(): MiniappManifestPlugin {
   let root = process.cwd();
   let outDir = 'dist';
   let command: 'build' | 'serve' = 'build';
@@ -279,20 +271,6 @@ export function miniappManifest(options: MiniappManifestOptions = {}): MiniappMa
       command = resolved.command;
       hmrWebSocketUrl = resolveHmrWebSocketUrl(resolved);
     },
-    async buildStart() {
-      if (command !== 'build' || process.env.HB_SDK_DEPLOY_BUILD === '1') return;
-      try {
-        await (options.enforceSdkVersion ?? defaultEnforceRemoteSdkVersion)({
-          sdkVersion: resolveSdkVersion(),
-          environment: resolveHeyboxApiBaseUrl({ env: process.env }),
-          serviceTag: process.env.HB_SDK_SERVICE_TAG,
-          allowPrerelease: true,
-        });
-      } catch (error) {
-        priorBuildError = toError(error);
-        throw priorBuildError;
-      }
-    },
     buildEnd(error) {
       if (error) {
         priorBuildError = priorBuildError ?? toError(error);
@@ -404,7 +382,7 @@ export default defineConfig({
 
 插件只接受单页应用：输出目录只能存在入口 `index.html`。build 会用结构化 HTML parser 校验入口，并把平台 CSP 插入 `<head>` 首位；已有 CSP 会原样保留，两份策略按浏览器交集生效。正式策略禁止 `fetch`、XHR、WebSocket、EventSource、Beacon、Worker、iframe、表单和对象加载等浏览器原生出口；业务网络请求应使用 `network.request()`。dev 使用相同策略，只额外放行当前 Vite 的精确 HMR WebSocket 地址。
 
-meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 会读取 `/user_miniprogram/public/sdk_config` 的 `minimumSdkVersion`；最新请求失败时只回退当前 Remote Environment 下 24 小时内的有效缓存，无缓存则默认阻断并提示升级 `@heybox/hb-sdk@latest`。`hb-sdk remote deploy`（包括 `--from-version`）不执行客户端最低版本查询或比较，但仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
+meta refresh、外部 anchor、`dns-prefetch`、`preconnect`、`prerender`、外部资源 URL 和额外 HTML 会使 build 失败。内联 script/style 允许，但 `unsafe-eval` 不允许。`dev` 和手动 Vite build 不再请求远端最低 SDK 版本；构建仍会把当前 `sdkVersion` 写入 Manifest，`hb-sdk remote deploy` 仍校验 Manifest 结构并经过服务端 precheck / submit-audit 策略。
 
 失败与警告语义：
 

package/skill/references/cli.md

@@ -165,11 +165,11 @@ HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1 hb-sdk remote deploy --api-base-url http://12
 
 `manifest.json` 仅作为提交审核接口的 `manifest` 字段提交，不会上传到 CDN。Vite 项目通过 `miniappManifest()` 插件生成；CLI 不会自动注入插件，请在 `vite.config.ts` 中显式挂载。小程序构建产物需要使用相对资源路径；`hb-sdk create` 模板会显式配置 `base: './'`，未配置 `base` 的项目也会由 `miniappManifest()` 在 build 时默认补成 `./`。构建产物只能在兼容的小黑盒 Runtime 中启动，普通浏览器直接打开时不会执行标准业务脚本。
 
-`remote deploy` 的本地构建和 `--from-version` 路径都不执行客户端 `minimumSdkVersion` 查询或比较；Manifest 结构校验、版本 precheck 和服务端 submit-audit 策略仍然生效。开发者手动执行 Vite build 时仍会运行最低 SDK 版本门禁。
+`dev`、手动 Vite build、`remote deploy` 的本地构建和 `--from-version` 路径都不执行客户端 `minimumSdkVersion` 查询或比较；Manifest 结构校验、版本 precheck 和服务端 submit-audit 策略仍然生效。
 
 默认发布策略是 `auto_publish=false`：运营审核通过后使用 `hb-sdk remote versions` 查看版本状态，再用 `hb-sdk remote release <version>` 发布。需要审核通过后自动发布并下架旧线上版本时，使用 `--auto-publish`。如需让指定用户预览未发布候选版本，使用 `hb-sdk remote allowlist add <heybox_id>` 管理预览白名单。
 
-内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`；手动 Vite build 的最低 SDK 版本门禁请求会同时携带该 header 和 query，deploy 子构建不执行该门禁。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
+内部测试或预发环境可通过 `HB_SDK_API_BASE_URL` / `HB_SDK_LOGIN_BASE_URL` 设置默认后台环境，也可以用 `--api-base-url` / `--login-base-url` 覆盖单次命令。自定义地址只接受 origin，不允许包含 path、query 或 hash；API origin 默认还必须是 Heybox 受信 HTTPS 域名，只有本地联调等场景可显式使用 `--allow-unsafe-api-base-url` 或 `HB_SDK_ALLOW_UNSAFE_API_BASE_URL=1` 放开。`apiBaseUrl` 影响 `hb-sdk remote` 里的远端平台后台 API，包括预检、CDN 上传凭证/回调、提交审核、版本、发布、撤回、下架、重新上架、详情和白名单等调用；`loginBaseUrl` 用于 `hb-sdk login` 的登录入口，以及 remote 命令前校验当前 CLI 登录态是否属于同一个登录环境。开发环境如需给后台请求带 `x-rylai-service-tag` 和 `special_tag`，优先用 `--service-tag <tag>` 或 `HB_SDK_SERVICE_TAG`。path-prefix 级 `special_tag` 仍可在 `packages/hb-sdk/src/cli/config.ts` 里按 `@heybox/hb-types` 的 `RylaiServiceTagConfig` 配置。日志只输出 origin，不输出带身份和签名参数的完整请求 URL。
 
 `hb-sdk doctor`、npm latest 检查、mock host 的 `network.request()` 不受这些配置影响。
 
@@ -256,20 +256,7 @@ hb-sdk remote square show
 
 `hb-sdk remote create` 会创建远端工坊小程序并写入当前项目绑定；已有绑定时必须传 `--force-bind` 才能覆盖。`hb-sdk remote bind <mini-program-id>` 会先校验当前 CLI 用户可管理目标小程序，再写入本地配置；`--force` 只允许覆盖本地绑定，不跳过远端校验。
 
-小程序名称、icon 和介绍图需要随版本提交审核，CLI 不再提供直接更新基础信息的命令。提交审核前在 `package.json.heybox.miniProgramProfile` 配置 `name`、HTTPS `iconUrl` 和至少一张 HTTPS `coverImageUrls`：
-
-```json
-{
-  "heybox": {
-    "miniProgramId": "mp_xxxxxxxx",
-    "miniProgramProfile": {
-      "name": "我的小程序",
-      "iconUrl": "https://img.example.test/icon.png",
-      "coverImageUrls": ["https://img.example.test/cover.png"]
-    }
-  }
-}
-```
+小程序名称、icon 和介绍图在开放平台「版本发布」中维护并随版本审核。CLI 项目配置只保留 `package.json.heybox.miniProgramId`；首次部署且没有历史审核资料时，服务端会使用默认名称「我的小程序」与平台默认图片。
 
 `hb-sdk remote square hide` 会隐藏当前绑定小程序在普通用户侧的小程序工坊广场展示；白名单用户仍可在小程序工坊广场看到，直接链接访问已发布版本也不受影响。`hb-sdk remote square show` 会恢复普通用户侧的小程序工坊广场展示。
 
@@ -281,7 +268,7 @@ Agent rules:
 
 - Use `hb-sdk remote entity list/current/switch` for developer entity inspection and switching.
 - Use `hb-sdk remote create` for create-and-bind and `hb-sdk remote bind <mini-program-id>` for binding an existing manageable remote mini-program.
-- Keep mini-program name, icon, and cover images in `package.json.heybox.miniProgramProfile`; these fields are submitted with version audit.
+- Do not require or submit mini-program name/icon/cover from CLI; maintain them on Open version publish. CLI project configuration contains only `package.json.heybox.miniProgramId`.
 - Explain that `remote create` creates under the current entity and that multi-entity non-TTY usage must confirm with `--yes`; `--yes` confirms current-entity usage but does not switch entities.
 - Explain that `remote bind` verifies the mini-program is manageable by the current entity and does not write `package.json.heybox.miniProgramId` on entity mismatch.
 - Use `hb-sdk remote info`, `hb-sdk remote access`, `hb-sdk remote list`, `hb-sdk remote versions`, `hb-sdk remote preview <version>`, `hb-sdk remote square show/hide`, and `hb-sdk remote allowlist ...` instead of sending users to Open when a matching CLI command exists.
@@ -398,7 +385,7 @@ npm run deploy
 
 - `npm run dev`：启动本地 Vite 服务和 `hb-sdk` 内置 mock runtime host，适合本地调试 SDK 能力；调试页内可点击按钮在 Mac 版 APP 中启动同一页面，也可以选择局域网网卡后用手机小黑盒 APP 扫码调试。手机需要与电脑处在同一局域网，并使用支持小程序调试壳的新版小黑盒 APP。Codex、VSCode 等内嵌浏览器可能无法唤起系统 APP，需要时请在系统浏览器中打开同一个调试页后重试。
 - `npm run build`：先执行 TypeScript 检查，再构建生产产物。
-- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。小程序名称、icon 和介绍图在 `package.json.heybox.miniProgramProfile` 中配置并随版本审核提交。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
+- `npm run deploy -- --release-note "..."`：运行 `hb-sdk remote deploy`，构建、上传并提交当前小程序版本审核。部署前需要先执行过 `npx hb-sdk login`；多主体账号还应通过 `npx hb-sdk remote entity current` 确认服务端 current entity。远端小程序可通过 `npx hb-sdk remote create` 在 current entity 下创建并绑定，或用 `npx hb-sdk remote bind <mini-program-id>` 绑定 current entity 可管理的已有小程序。小程序名称、icon 和介绍图在开放平台版本发布中维护；CLI 项目配置只保留 `heybox.miniProgramId`，首次部署服务端会使用默认名与默认图。`selectedEntity` 只是 CLI 登录缓存中的提示快照，实际 deploy/create/bind 以服务端 current entity 为准。默认审核通过后用 `hb-sdk remote versions` 查看状态，再用 `hb-sdk remote release <version>` 发布，如需审核通过后自动发布可追加 `--auto-publish`。顶层 `hb-sdk deploy` 已删除，不再作为兼容别名保留。
 
 ## 更多能力
 

package/skill/scripts/sync-references.mjs

@@ -429,7 +429,7 @@ Agent rules:
 
 - Use \`hb-sdk remote entity list/current/switch\` for developer entity inspection and switching.
 - Use \`hb-sdk remote create\` for create-and-bind and \`hb-sdk remote bind <mini-program-id>\` for binding an existing manageable remote mini-program.
-- Keep mini-program name, icon, and cover images in \`package.json.heybox.miniProgramProfile\`; these fields are submitted with version audit.
+- Do not require or submit mini-program name/icon/cover from CLI; maintain them on Open version publish. CLI project configuration contains only \`package.json.heybox.miniProgramId\`.
 - Explain that \`remote create\` creates under the current entity and that multi-entity non-TTY usage must confirm with \`--yes\`; \`--yes\` confirms current-entity usage but does not switch entities.
 - Explain that \`remote bind\` verifies the mini-program is manageable by the current entity and does not write \`package.json.heybox.miniProgramId\` on entity mismatch.
 - Use \`hb-sdk remote info\`, \`hb-sdk remote access\`, \`hb-sdk remote list\`, \`hb-sdk remote versions\`, \`hb-sdk remote preview <version>\`, \`hb-sdk remote square show/hide\`, and \`hb-sdk remote allowlist ...\` instead of sending users to Open when a matching CLI command exists.

package/skill/skill.json

@@ -1,11 +1,11 @@
 {
   "name": "hb-sdk",
-  "skillVersion": "0.6.1+skill.31b72826f59b",
+  "skillVersion": "0.6.3+skill.e46d946d0d66",
   "sdk": {
     "package": "@heybox/hb-sdk",
-    "version": "0.6.1",
-    "compatibility": "0.6.1"
+    "version": "0.6.3",
+    "compatibility": "0.6.3"
   },
   "source": "https://open.xiaoheihe.cn/agent-skills/hb-sdk",
-  "integrity": "sha256-31b72826f59beadd927f3f2cafcba36bbf9e035915a7734d0b990767fc34d926"
+  "integrity": "sha256-e46d946d0d668d1f9fc60d49d0552ff3f7d8c15d69823e979b20307cdcb42a36"
 }

package/types/miniapp-publish/index.d.ts

@@ -2,7 +2,6 @@ export declare const MINIAPP_UPLOAD_SCOPE = "activity";
 export declare const ACTIVITY_UPLOAD_KEY_MAX_LENGTH = 64;
 export declare const MINIAPP_UPLOAD_BATCH_SIZE = 50;
 export declare const MINIAPP_UPLOAD_TOTAL_SIZE_LIMIT_BYTES: number;
-export declare const PUBLIC_USER_MINIPROGRAM_SDK_CONFIG_API_PATH = "/user_miniprogram/public/sdk_config";
 export declare const USER_MINIPROGRAM_ACCESS_STATUS_API_PATH = "/mall/developer/user_miniprogram/access_status";
 export declare const DEVELOPER_ENTITY_LIST_API_PATH = "/mall/developer/entity/list";
 export declare const DEVELOPER_ENTITY_SWITCH_API_PATH = "/mall/developer/entity/switch";

package/types/vite/index.d.ts

@@ -1,18 +1,12 @@
-import { enforceViteSdkVersion as defaultEnforceRemoteSdkVersion } from './sdk-version-gate';
 type MiniappManifestPlugin = {
     name: string;
     config: (config: MiniappManifestUserConfig) => MiniappManifestUserConfig | void;
     configResolved: (resolved: MiniappManifestResolvedConfig) => void;
-    buildStart: () => Promise<void>;
     /** Rollup 在构建失败后仍会跑 closeBundle；用 buildEnd 记录真实错误，避免二次校验掩盖原因。 */
     buildEnd: (error?: Error) => void;
     transformIndexHtml: (html: string) => string;
     closeBundle: (this: MiniappManifestPluginContext) => Promise<void>;
 };
-export interface MiniappManifestOptions {
-    /** 仅供平台测试和自托管 Remote Environment adapter 使用。 */
-    enforceSdkVersion?: typeof defaultEnforceRemoteSdkVersion;
-}
 interface MiniappManifestUserConfig {
     base?: string;
     define?: Record<string, string>;
@@ -37,5 +31,5 @@ interface MiniappManifestResolvedConfig {
         };
     };
 }
-export declare function miniappManifest(options?: MiniappManifestOptions): MiniappManifestPlugin;
+export declare function miniappManifest(): MiniappManifestPlugin;
 export {};

package/types/cli/auth/base-url.d.ts

@@ -1,20 +0,0 @@
-export interface HeyboxBaseUrlEnv extends NodeJS.ProcessEnv {
-    HB_SDK_API_BASE_URL?: string;
-    HB_SDK_ALLOW_UNSAFE_API_BASE_URL?: string;
-    HB_SDK_LOGIN_BASE_URL?: string;
-}
-export interface HeyboxBaseUrlResolveOptions {
-    env?: HeyboxBaseUrlEnv;
-}
-export interface HeyboxApiBaseUrlResolveOptions extends HeyboxBaseUrlResolveOptions {
-    allowUnsafeApiBaseUrl?: boolean;
-    apiBaseUrl?: string;
-}
-export interface HeyboxLoginBaseUrlResolveOptions extends HeyboxBaseUrlResolveOptions {
-    loginBaseUrl?: string;
-}
-export declare const HEYBOX_API_BASE_URL = "https://api.xiaoheihe.cn";
-export declare const HEYBOX_LOGIN_BASE_URL = "https://login.xiaoheihe.cn";
-export declare function resolveHeyboxApiBaseUrl(options?: HeyboxApiBaseUrlResolveOptions): string;
-export declare function resolveHeyboxLoginBaseUrl(options?: HeyboxLoginBaseUrlResolveOptions): string;
-export declare function normalizeHeyboxOriginUrl(value: string, label: string): string;

package/types/cli/config.d.ts

@@ -1,11 +0,0 @@
-import type { RylaiServiceTagConfig } from '@heybox/hb-types';
-export type HeyboxCliRequestConfig = RylaiServiceTagConfig;
-export declare function configureHeyboxCliRequestConfig(config: HeyboxCliRequestConfig): void;
-export declare function readHeyboxCliRequestConfig(): HeyboxCliRequestConfig;
-/**
- * 当 tag 为非空字符串时，把它设为 CLI 全局 default_tag；为空时不改动现有配置，
- * 避免清掉 env 预设阶段已注入的值。
- */
-export declare function applyServiceTagIfNeeded(tag: unknown): void;
-export declare function resolveHeyboxRylaiServiceTag(pathWithQuery?: string, config?: RylaiServiceTagConfig): string | undefined;
-export declare function normalizeHeyboxRylaiServiceTagConfig(config: HeyboxCliRequestConfig): RylaiServiceTagConfig;

package/types/miniapp-manifest/sdk-version-policy.d.ts

@@ -1,9 +0,0 @@
-export declare function resolveMinimumSdkVersion(options: {
-    cacheDir: string;
-    environment: string;
-    fetchMinimumSdkVersion: () => Promise<string>;
-    now?: number;
-}): Promise<string>;
-export declare function validateCurrentSdkVersion(currentSdkVersion: string, minimumSdkVersion: string, options: {
-    allowPrerelease: boolean;
-}): string;